fix: harden Copilot binding cleanup and config recovery

[sabbour]

Summary

• harden platform/project Copilot binding cleanup and token revocation safety
• treat malformed BYOK or credential payloads as unconfigured instead of breaking admin recovery
• migrate and validate platform-default Copilot bindings safely across SQLite/Postgres moves

Changeset exemption: Follow-up hardening for the already-documented platform-default Copilot feature shipped in #1063.

Testing

• dotnet test tests/Agentweaver.Tests/Agentweaver.Tests.csproj --filter "FullyQualifiedName!~PostgresIntegration"
• dotnet test tests/Agentweaver.Tests/Agentweaver.Tests.csproj --filter "FullyQualifiedNamePlatformDefaultCopilotBindingServiceTests|FullyQualifiedNameProjectCopilotBindingServiceTests|FullyQualifiedName~GitHubConnectionsCredentialVaultTests"
• npm run build
• npm run test -- App.test.tsx PlatformSettingsPage.test.tsx

[github-actions]

📝 Docs sync reminder

This PR changes code in doc-relevant paths but does not touch docs/**.
If this change adds or alters a feature, API endpoint, MCP tool, blueprint, or workflow,
please update the docs in the same PR (the definition of done includes docs).

Changed source files

apps/Agentweaver.Api/Endpoints/AuthEndpoints.cs

How to update fast

• Invoke the agentweaver-docs-sync skill (.copilot/skills/agentweaver-docs-sync/SKILL.md) for the playbook.
• Regenerate auto-derived reference: node scripts/gen-docs.mjs then commit.
• Build to verify: cd docs && npm ci && npm run build.

This is a non-blocking reminder — it will not prevent merge. See .github/DOCS_SYNC.md.